Vercel breach traced to compromised AI tool used by an employee
Vercel, the cloud platform that hosts websites and web apps for developers, confirmed in April that attackers gained access to internal systems and customer data after compromising Context AI, a third-party AI tool used by one of its employees.
The incident matters well beyond Vercel's own customers. It shows how a single connected AI app, granted access to a work account, can become a route into a software company's production environment and the secrets its customers store there.
What happened
According to Vercel's security bulletin, the attacker used the Context AI compromise to take over the employee's Google Workspace account, then the employee's Vercel account, and pivoted into a Vercel environment. From there the attacker listed and decrypted customers' "non-sensitive" environment variables, which are stored in a form that can be read back as plain text. Such variables often hold API keys, tokens and database credentials.
Vercel brought in Google Mandiant and other responders and notified law enforcement. It said it worked with GitHub, Microsoft, npm and Socket to confirm that none of its published npm packages had been tampered with.
On April 23, Vercel said its expanded investigation had found a small number of customer accounts with evidence of compromise that predated the incident, TechCrunch reported. Chief executive Guillermo Rauch wrote that logs showed rapid and wide-ranging API use focused on listing environment variables, and pointed to malware that hunts for tokens and keys to Vercel and other cloud accounts. Context AI confirmed its own breach.
What we don't know yet
Vercel has not said how many customers were affected or named the attacker, which it describes as highly sophisticated. Security researchers reported that a Context AI employee's computer was infected with information-stealing malware, but Vercel has not confirmed the initial cause. The company later said all remediation was complete.
What to do
Vercel customers should rotate any secrets stored as non-sensitive environment variables, then mark them as sensitive so their values cannot be read back. Enable multi-factor authentication, review activity logs and recent deployments, and set Deployment Protection to at least Standard. Google Workspace administrators should check for the Context AI OAuth app listed in Vercel's indicators of compromise and review which third-party AI tools staff have connected to work accounts.
